CVE-2025-25467

CriticalRCE

Published: 18 February 2025

Published

18 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0018 39.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25467 is a critical-severity Code Injection (CWE-94) vulnerability in Videolan (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the CVE by requiring timely identification, reporting, and remediation of the memory management flaw in libx264.

SI-16 Memory Protection good match

prevent

Implements memory protection mechanisms that prevent unauthorized code execution from memory corruption triggered by crafted AAC files.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Enables vulnerability scanning to identify the presence of CVE-2025-25467 in libx264 components for subsequent remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

The vulnerability enables remote arbitrary code execution via a crafted AAC file processed by client applications (e.g., media players or video encoders) using libx264, directly mapping to T1203: Exploitation for Client Execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.

Deeper analysisAI

CVE-2025-25467 is a critical memory management vulnerability in the libx264 git master branch, an open-source H.264 video encoding library. The issue stems from insufficient tracking and releasing of allocated used memory, classified under CWE-94 (Improper Control of Generation of Code). Published on 2025-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.

Remote attackers require no privileges or user interaction to exploit this flaw. By creating a specially crafted AAC file and inducing a victim to process it through an application using the vulnerable libx264 git master—such as a media player or video encoder—the attacker can trigger the memory handling defect, leading to arbitrary code execution on the target system.

Mitigation details are available in the upstream issue tracker at https://code.videolan.org/videolan/x264/-/issues/75, where practitioners should check for patches or workarounds applicable to affected builds.